Institutional Review Board
1204 Marie Mount Hall ● 7814 Regents Drive ● College Park, MD 20742
301-405-4212 ● irb@umd.edu

CONSENT TO PARTICIPATE

Project Title Creating a Robust Dataset of Malicious Posts on Social Media
Purpose of the Study This research is being conducted by Dave Levin at the University of Maryland, College Park. We are inviting you to participate in this research project to ask for your help identifying scam posts on Facebook. The purpose of this research project is to create a large dataset of malicious social media posts in an effort to further analyse their patterns.
Procedures If you agree to participate in this study, you will be asked to install the MC2 Scam Reporter for Facebook extension if you have not already done so. The extension will add a "sign consent form" button above all posts until the consent form has been completed.

The age bracket you select on the consent form is stored locally on your device. To protect your anonymity, this information will be excluded from reports whenever the number of participants in a specific group is too small to ensure confidentiality.

Once the consent form is completed the extension will add a “Is this a scam? (UMD)” button above Facebook posts. When the button is clicked you will be asked to identify how likely the post is to be a scam, with the option to provide additional information if desired. Once you respond to the prompt and press “Send to UMD” the following (when applicable) will be sent to UMD researchers for analysis:
  • A timestamp of when the report was generated
  • The photo(s) attached to the post
  • The post’s description
  • If the post is sponsored
  • The name of the account which owns the post
  • The link to the account which owns the post
  • The name of the Facebook group which the post is associated with
  • The link of the Facebook group which the post is associated with
  • The number of shares, reactions and comments linked to the post
  • Why you reported the post (if provided)
  • Your age bracket (only when confidentiality can be ensured)
  • Any additional comments you include in the report
  • A report identifier, which allows the research team to discard duplicate reports of the same post by a single participant.
When available, the following will also be collected for Facebook Marketplace posts
  • The item's title
  • The item's price
  • When it was listed
  • Any badges awarded to the seller
  • The listing location
  • When the seller joined Facebook
  • Additional information provided by the seller (color, condition, brand etc.)
The following will NOT be collected when a post is reported:
  • The IP address of the computer that sent the report
  • The Facebook account logged into by you when the report was generated.
  • A unique identifier that allows the research team to link two different reported posts to the same reporter.
The research team is not responsible for removing or flagging these posts on the Facebook platform.

We will not store any information that would allow us to associate any reports to the participants who submitted them. The extension will store a unique identifier on your device, but that identifier is never sent to our servers. The report identifier is the hash of your unique identifier and the post URL which is used to discard duplicate reports of the same post by a single participant.
Potential Risks and Discomforts Third-Party Platform Risk:

This study involves interacting with content on Facebook using a research browser extension. While we are not aware of any policy violations associated with this tool, Facebook and other online platforms maintain their own terms of service and account policies. We cannot guarantee how a platform may interpret the use of browser extensions. In rare cases, online accounts could be restricted or suspended. We believe this risk to be minimal.

Possible risks and discomforts can arise if you choose to report posts that contain private and sensitive topics. These risks are mitigated by preventing accidental reporting by requiring you to select a confidence rating and “submit report” before any data is saved. Finally no data will be collected that can connect your identity to the reported posts.
Potential Benefits There are no direct benefits provided to you for participating in this study. However, potential benefits include a deeper understanding of malicious posts on social media which could lead to better mitigation techniques
Confidentiality All information gathered during this study will be stored on a secure UMD AWS Server. Only those actively working on the research will be able to access the data. Reported posts are never linked back to your account.

If we write a report or article about this research project, your identity will be protected to the maximum extent possible. Your information may be shared with representatives of the University of Maryland, College Park or governmental authorities if you or someone else is in danger or if we are required to do so by law.
Compensation There will be no compensation provided for your participation in this study.
Right to Withdraw and Questions Your participation in this research is completely voluntary. You may choose not to take part at all. If you decide to participate in this research, you may stop participating at any time.

If you decide not to participate in this study or if you stop participating at any time, you will not be penalized or lose any benefits to which you otherwise qualify. If you decide to stop taking part in the study, if you have questions, concerns, or complaints, or if you need to report an injury related to the research, please contact the investigator:

Dave Levin
5222 Iribe Center
dml@umd.edu
(301) 405-8515
Participant Rights If you have questions about your rights as a research participant or wish to report a research-related injury, please contact:

University of Maryland College Park
Institutional Review Board Office
1204 Marie Mount Hall
College Park, Maryland, 20742
E-mail: irb@umd.edu
Telephone: 301-405-0678

For more information regarding participant rights, please visit:
https://research.umd.edu/research-resources/research-compliance/institutional-review-board-irb/research-participants

This research has been reviewed according to the University of Maryland, College Park IRB procedures for research involving human subjects.

KIRB Package: 3648-1

Statement of Consent

Your signature indicates that you are at least 18 years of age; you have read this consent form or have had it read to you; your questions have been answered to your satisfaction and you voluntarily agree to participate in this research study. You can print off this consent form at any time by clicking the extension icon at the top of your browser followed by 'review the consent form'.

If you agree to participate, please sign your name below.